collect_all_blobs scanned all seven registry prefixes for keys
containing /blobs/ or /tarballs/, but collect_referenced_digests only
reads Docker manifests. Non-Docker artifacts (notably npm tarballs)
were collected but never marked as referenced, so running gc without
--dry-run would delete them.
Restrict blob collection to docker/ until per-registry reference
resolution exists for other registry types.
// ticktockbent
9d3c248ea5